firefox.settings.services.mozilla.com/v1/
200 OK 939 B URL HTTP/1.1 firefox.settings.services.mozilla.com/v1/
IP
File type JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Hash c9df6b36bf16969ac566c1b798362e4a
e56eff34815153ae019a4bf63eb9746dd9ae2e5b
33c1175144ab2be42c9de383f7893a6e60cd1f21f282eacb413d546331db3fa0
GET /v1/ HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 939
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: Content-Length, Retry-After, Alert, Content-Type, Backoff
Cache-Control: max-age=3600
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Date: Sun, 16 Oct 2022 05:50:25 GMT
Expires: Sun, 16 Oct 2022 06:32:00 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
X-Cache: Hit from cloudfront
Via: 1.1 4f01f770085624552bc30a98954f963a.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: yRnkMwLcmi7lJJrtPoPbk95GPCK9MTctn2dgorcxjJlm7UGfCDWIjA==
Age: 2530
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash 07b3389fc24c0f8eb82a9d05b546d17e
02716741b8952e548b9a223adbb3f16204eef2b2
25e13458988115ae1f8176cb2328dbfebd612eabebf256b4af64594d5e23d6ca
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "25E13458988115AE1F8176CB2328DBFEBD612EABEBF256B4AF64594D5E23D6CA"
Last-Modified: Sat, 15 Oct 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6460
Expires: Sun, 16 Oct 2022 08:20:15 GMT
Date: Sun, 16 Oct 2022 06:32:35 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash a57d0f62d9bd29668b94a513fa45d18e
d7cb263502e21f9235b4523a596e2138d22042ec
df7acd4fe34cc9c4945a5d83ef538105a73dfc1a8b485bc7a62488c5406b1294
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "DF7ACD4FE34CC9C4945A5D83EF538105A73DFC1A8B485BC7A62488C5406B1294"
Last-Modified: Sat, 15 Oct 2022 02:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=18190
Expires: Sun, 16 Oct 2022 11:35:45 GMT
Date: Sun, 16 Oct 2022 06:32:35 GMT
Connection: keep-alive
content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
200 OK 5.3 kB URL HTTP/2 content-signature-2.cdn.mozilla.net/chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain
IP
File type PEM certificate\012- , ASCII text
Hash 67d5a988edcda47bc3b3b3f65d32b4b6
d4f0e0da8b3690cc7da925026d3414b68c7d954f
55e4848e3ec682e808ce7ee70950f86179c43af4f81926d826a95edfda395a78
GET /chains/remote-settings.content-signature.mozilla.org-2022-11-19-18-50-54.chain HTTP/1.1
Host: content-signature-2.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
x-amz-id-2: xEwF5yO19FJY2ot+BeLmlG0WidtsHnmdQFrS7vhHNQ5J1P7BhhID5G/lZGI1Uuenc68hPLdxN7o=
x-amz-request-id: VCDS3G6NK0MJARKV
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sun, 16 Oct 2022 05:34:55 GMT
age: 3460
last-modified: Fri, 30 Sep 2022 18:50:55 GMT
etag: "67d5a988edcda47bc3b3b3f65d32b4b6"
content-type: binary/octet-stream
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2
extensions.net/http:/extensions.net/mtm/direct/.ejxdje0owiaqhe_csmixcam2pyuz4hriyiowvhlj3avwf7p773s_d3fltpyeeljamrnkqhkomdctxk6zzwqbq8xcsnlnlftcxjzay-saci2u5ealxoidbq4tvraykf80-o7a79qjdaemkpjd-jf3hokxrjkyuc27evg5ym4qxrzytauy2m39sf8fxfmfcavhna:1odgco:cqjyysujn86kwgrm-ksso6ucpt0/0
200 OK 7.9 kB URL HTTP/1.1 extensions.net/http:/extensions.net/mtm/direct/.ejxdje0owiaqhe_csmixcam2pyuz4hriyiowvhlj3avwf7p773s_d3fltpyeeljamrnkqhkomdctxk6zzwqbq8xcsnlnlftcxjzay-saci2u5ealxoidbq4tvraykf80-o7a79qjdaemkpjd-jf3hokxrjkyuc27evg5ym4qxrzytauy2m39sf8fxfmfcavhna:1odgco:cqjyysujn86kwgrm-ksso6ucpt0/0
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (529)
Hash c1f54ed8eaeb1d6bb3e85fd6fee9f70e
f2a93014c1e274912ef4e11a07c385a1088e0e58
be0fbea6e5f76393d0dec5d8f7832620c80b4cbd76368735c5ff0d9453ae7ba2
Analyzer Verdict Alert fortinet Malware
GET /http:/extensions.net/mtm/direct/.ejxdje0owiaqhe_csmixcam2pyuz4hriyiowvhlj3avwf7p773s_d3fltpyeeljamrnkqhkomdctxk6zzwqbq8xcsnlnlftcxjzay-saci2u5ealxoidbq4tvraykf80-o7a79qjdaemkpjd-jf3hokxrjkyuc27evg5ym4qxrzytauy2m39sf8fxfmfcavhna:1odgco:cqjyysujn86kwgrm-ksso6ucpt0/0 HTTP/1.1
Host: extensions.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
server: openresty/1.13.6.1
date: Sun, 16 Oct 2022 06:32:35 GMT
content-type: text/html; charset=utf-8
content-length: 7944
vary: Accept-Language
content-language: en
connection: close
contile.services.mozilla.com/v1/tiles
200 OK 12 B URL HTTP/2 contile.services.mozilla.com/v1/tiles
IP
File type JSON data\012- , ASCII text, with no line terminators
Hash 23e88fb7b99543fb33315b29b1fad9d6
a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
GET /v1/tiles HTTP/1.1
Host: contile.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
date: Sun, 16 Oct 2022 06:32:35 GMT
content-type: application/json
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2
extensions.net/mtm/async/.eJxdkMtygkAQRf-FpRExoIKm8i1WO_TAvJ_ADKn8ezDJJtnde0_35nwUk2fFrajGGO2twhRRB2Z0OGiMlYqq6plHEqsD8tRzPJqFgRvxToJiiYCqbZ7W0-hZZmaZR8kbmBfa2rZtwr1vqIw2I0oOymvhRmFUT2ISl3Vd3MN1iQQttaSRJL5CLgMQVk9nBJkM6x_uFGcPWdDuWJoW2qvjPaASlvclp81oRPJc5InULc7DOauTS37NEaZcq-YaaEcTVZTAPGq4vZp-IOZGHM85TFx3F7EMXpUiFPsC_BA2EVvySNGj_ymjCfGuQeFW_9p5_hCCNm4kbmhTqOQerJWMQNyuqvRcXtL_Vck39348XPdMwYAVzIz-xgUfdr-rdt-8Kz6_AFc7l_4:1ojxCN:CWW36Lzw9oHs8UrIu-rAmIL9EC0/1/0
200 OK 451 B URL HTTP/1.1 extensions.net/mtm/async/.eJxdkMtygkAQRf-FpRExoIKm8i1WO_TAvJ_ADKn8ezDJJtnde0_35nwUk2fFrajGGO2twhRRB2Z0OGiMlYqq6plHEqsD8tRzPJqFgRvxToJiiYCqbZ7W0-hZZmaZR8kbmBfa2rZtwr1vqIw2I0oOymvhRmFUT2ISl3Vd3MN1iQQttaSRJL5CLgMQVk9nBJkM6x_uFGcPWdDuWJoW2qvjPaASlvclp81oRPJc5InULc7DOauTS37NEaZcq-YaaEcTVZTAPGq4vZp-IOZGHM85TFx3F7EMXpUiFPsC_BA2EVvySNGj_ymjCfGuQeFW_9p5_hCCNm4kbmhTqOQerJWMQNyuqvRcXtL_Vck39348XPdMwYAVzIz-xgUfdr-rdt-8Kz6_AFc7l_4:1ojxCN:CWW36Lzw9oHs8UrIu-rAmIL9EC0/1/0
IP
File type ASCII text, with very long lines (451), with no line terminators
Hash 12d53218210732ecef6c2211fdd4dfdb
8de8bdc31e952b62f5414ec8c6ad05f52f20a741
4a77555f2580ed0177b501f8d4bbf531f4efc25a853a2f385f5472ba53167162
Analyzer Verdict Alert fortinet Malware
GET /mtm/async/.eJxdkMtygkAQRf-FpRExoIKm8i1WO_TAvJ_ADKn8ezDJJtnde0_35nwUk2fFrajGGO2twhRRB2Z0OGiMlYqq6plHEqsD8tRzPJqFgRvxToJiiYCqbZ7W0-hZZmaZR8kbmBfa2rZtwr1vqIw2I0oOymvhRmFUT2ISl3Vd3MN1iQQttaSRJL5CLgMQVk9nBJkM6x_uFGcPWdDuWJoW2qvjPaASlvclp81oRPJc5InULc7DOauTS37NEaZcq-YaaEcTVZTAPGq4vZp-IOZGHM85TFx3F7EMXpUiFPsC_BA2EVvySNGj_ymjCfGuQeFW_9p5_hCCNm4kbmhTqOQerJWMQNyuqvRcXtL_Vck39348XPdMwYAVzIz-xgUfdr-rdt-8Kz6_AFc7l_4:1ojxCN:CWW36Lzw9oHs8UrIu-rAmIL9EC0/1/0 HTTP/1.1
Host: extensions.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://extensions.net/http:/extensions.net/mtm/direct/.ejxdje0owiaqhe_csmixcam2pyuz4hriyiowvhlj3avwf7p773s_d3fltpyeeljamrnkqhkomdctxk6zzwqbq8xcsnlnlftcxjzay-saci2u5ealxoidbq4tvraykf80-o7a79qjdaemkpjd-jf3hokxrjkyuc27evg5ym4qxrzytauy2m39sf8fxfmfcavhna:1odgco:cqjyysujn86kwgrm-ksso6ucpt0/0
Connection: keep-alive
HTTP/1.1 200 OK
server: openresty/1.13.6.1
date: Sun, 16 Oct 2022 06:32:36 GMT
content-type: text/html; charset=utf-8
content-length: 451
x-mtm-path: 7
x-mtm-prov: 300:0.00;308:0.00
x-mtm-rd: 0.00
vary: Accept-Language
content-language: en
set-cookie: mtm_delivered=WyJleHRlbnNpb25zLm5ldCIsImh0dHA6Ly93d3cxLmV4dGVuc2lvbnMubmV0Lz90bT0xJnN1YmlkND0xNjY1OTAxOTU2LjAxMjc3MDAwMDAmS1cxPUxvd2VzdCUyMENhciUyMEluc3VyYW5jZSUyMFJhdGVzJktXMj1Mb3dlc3QlMjBDYXIlMjBJbnN1cmFuY2UlMjBSYXRlcyZLVzM9RWxpdGUlMjBEYXRpbmclMjBTZXJ2aWNlcyZLVzQ9U29jaWFsJTIwTWVkaWElMjBBdXRvbWF0aW9uJTIwTWFya2V0aW5nJTIwU29mdHdhcmUmS1c1PUIyQiUyMFRyYXZlbCUyMEJvb2tpbmclMjBTeXN0ZW0mS1c2PVNvY2lhbCUyME1lZGlhJTIwQXV0b21hdGlvbiUyME1hcmtldGluZyUyMFNvZnR3YXJlJktXNz1PbmxpbmUlMjBDYXJlZXIlMjBDb3Vuc2VsaW5nJTIwUHJvZ3JhbXMmS1c4PU1ha2UlMjBNb25leSUyMEZyb20lMjBIb21lJktXOT1CZXN0JTIwTW9ydGdhZ2UlMjBSZWZpbmFuY2luZyUyMFJhdGVzJnNlYXJjaGJveD0wJmJhY2tmaWxsPTAiLDEsIjIwMjItMTAtMTYgMDY6MzI6MzYiLDEsIjE2NjU5MDE5NTYuMDEyNzcwMDAwMCIsMzA4LG51bGwsbnVsbF0:1ojxCO:za8nQz6TNk9PR60x1twAp0fqQQw; expires=Sun, 16-Oct-2022 07:32:36 GMT; Max-Age=3600; Path=/
connection: close
firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
200 OK 329 B URL HTTP/1.1 firefox.settings.services.mozilla.com/v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US
IP
File type JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Hash 0333b0655111aa68de771adfcc4db243
63f295a144ac87a7c8e23417626724eeca68a7eb
60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1
Host: firefox.settings.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 329
Connection: keep-alive
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: ETag, Expires, Content-Length, Cache-Control, Pragma, Content-Type, Alert, Backoff, Last-Modified, Retry-After
Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
Last-Modified: Fri, 25 Mar 2022 17:45:46 GMT
Strict-Transport-Security: max-age=31536000
X-Content-Type-Options: nosniff
Date: Sun, 16 Oct 2022 06:07:44 GMT
Cache-Control: max-age=3600
Expires: Sun, 16 Oct 2022 06:08:15 GMT
ETag: "1648230346554"
X-Cache: Hit from cloudfront
Via: 1.1 814e8c24454087e83cd261a6cf477166.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: pAvJPwV-3Rf2hWif48LWeJcWt5Mo38UBinZgGm2tonLtbaxo6nd5_A==
Age: 1493
ocsp.digicert.com/
200 OK 471 B IP
Hash 301aafc13bc66315321d9476df002258
e6bfd29899543fcd4d1b332623757bbad355306f
c64315afdfcf146b16942d981588ed912650472c5e2bba7b6f8dee396d820860
POST / HTTP/1.1
Host: ocsp.digicert.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Accept-Ranges: bytes
Age: 3729
Cache-Control: max-age=95788
Content-Type: application/ocsp-response
Date: Sun, 16 Oct 2022 06:32:36 GMT
Etag: "634a6a1f-1d7"
Expires: Mon, 17 Oct 2022 09:09:04 GMT
Last-Modified: Sat, 15 Oct 2022 08:06:55 GMT
Server: ECS (ska/F716)
X-Cache: HIT
Content-Length: 471
push.services.mozilla.com/
101 Switching Protocols 0 B URL HTTP/1.1 push.services.mozilla.com/
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET / HTTP/1.1
Host: push.services.mozilla.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: YSnBfeUMI5JBhcLBgT+DbQ==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket
HTTP/1.1 101 Switching Protocols
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: x3JVFxoUTX8RPEDr5rwdXSiGBPQ=
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash a239968682150ba8fb61f7b2101edba3
35724b1e7f236cddd2e9c542a0da63d9e915c310
e2cb65724d3870506a1efcfd90f43c61f87bb694b0c2cb07568bf1aaea7d1d98
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E2CB65724D3870506A1EFCFD90F43C61F87BB694B0C2CB07568BF1AAEA7D1D98"
Last-Modified: Fri, 14 Oct 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6715
Expires: Sun, 16 Oct 2022 08:24:33 GMT
Date: Sun, 16 Oct 2022 06:32:38 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash a239968682150ba8fb61f7b2101edba3
35724b1e7f236cddd2e9c542a0da63d9e915c310
e2cb65724d3870506a1efcfd90f43c61f87bb694b0c2cb07568bf1aaea7d1d98
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E2CB65724D3870506A1EFCFD90F43C61F87BB694B0C2CB07568BF1AAEA7D1D98"
Last-Modified: Fri, 14 Oct 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6715
Expires: Sun, 16 Oct 2022 08:24:33 GMT
Date: Sun, 16 Oct 2022 06:32:38 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash a239968682150ba8fb61f7b2101edba3
35724b1e7f236cddd2e9c542a0da63d9e915c310
e2cb65724d3870506a1efcfd90f43c61f87bb694b0c2cb07568bf1aaea7d1d98
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E2CB65724D3870506A1EFCFD90F43C61F87BB694B0C2CB07568BF1AAEA7D1D98"
Last-Modified: Fri, 14 Oct 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6715
Expires: Sun, 16 Oct 2022 08:24:33 GMT
Date: Sun, 16 Oct 2022 06:32:38 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash a239968682150ba8fb61f7b2101edba3
35724b1e7f236cddd2e9c542a0da63d9e915c310
e2cb65724d3870506a1efcfd90f43c61f87bb694b0c2cb07568bf1aaea7d1d98
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E2CB65724D3870506A1EFCFD90F43C61F87BB694B0C2CB07568BF1AAEA7D1D98"
Last-Modified: Fri, 14 Oct 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6715
Expires: Sun, 16 Oct 2022 08:24:33 GMT
Date: Sun, 16 Oct 2022 06:32:38 GMT
Connection: keep-alive
r3.o.lencr.org/
200 OK 503 B IP
ASN #20940 Akamai International B.V.
Hash a239968682150ba8fb61f7b2101edba3
35724b1e7f236cddd2e9c542a0da63d9e915c310
e2cb65724d3870506a1efcfd90f43c61f87bb694b0c2cb07568bf1aaea7d1d98
POST / HTTP/1.1
Host: r3.o.lencr.org
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Server: nginx
Content-Type: application/ocsp-response
Content-Length: 503
ETag: "E2CB65724D3870506A1EFCFD90F43C61F87BB694B0C2CB07568BF1AAEA7D1D98"
Last-Modified: Fri, 14 Oct 2022 00:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6715
Expires: Sun, 16 Oct 2022 08:24:33 GMT
Date: Sun, 16 Oct 2022 06:32:38 GMT
Connection: keep-alive
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9cf0a31c-c85d-44f5-805c-d721336ee8be.jpeg
200 OK 9.5 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9cf0a31c-c85d-44f5-805c-d721336ee8be.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 8134d82ebf2ab56f6263871af7dddd04
04f84545a02a942336e70de3c4bf25dafcb8552b
e85d244c6a2aaa6fd45303d88a01ae8cacb1efa0f8cda21f2fe48b53d8ca3a97
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9cf0a31c-c85d-44f5-805c-d721336ee8be.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 9524
x-amzn-requestid: 5bbf3c66-5b84-4783-884f-b5f677c834fe
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Z-WZKGQfIAMFbVA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6348d107-57a5d87b0a9b44842ca2808d;Sampled=0
x-amzn-remapped-date: Fri, 14 Oct 2022 03:01:27 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: K7wALlRHb9_IKjHi0MDbNUm4oycnqSggqHRTUMXfsqwLA0D5bVNcNw==
via: 1.1 0cf6c59c77f0fff670ae085179adc458.cloudfront.net (CloudFront), 1.1 5397b304713f6301c7c94ac084b6ed08.cloudfront.net (CloudFront), 1.1 google
date: Sun, 16 Oct 2022 04:53:50 GMT
age: 5928
etag: "04f84545a02a942336e70de3c4bf25dafcb8552b"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa6ea4d5d-0df9-4cfe-a9fc-e70b8e32f8ef.jpeg
200 OK 13 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa6ea4d5d-0df9-4cfe-a9fc-e70b8e32f8ef.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 54edb9ab897821172fc13756df376ee7
2010f9656d87e6f5220f131628c537720c3673e1
6694c1be0adf97fa77d1bfa29337d9e609b729a58d42e141e9bb55ed6367b1d8
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fa6ea4d5d-0df9-4cfe-a9fc-e70b8e32f8ef.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 13261
x-amzn-requestid: dd760e09-701e-4956-9723-386edc97c694
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Z0fH6FzIoAMFzJg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6344deff-197cf4f048e146af5654d0bd;Sampled=0
x-amzn-remapped-date: Tue, 11 Oct 2022 03:11:59 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: pP54mPlXuBb9IBf70jnGOLv63ktU422L4wCZ_4hqsSfMrSF3UrkVfw==
via: 1.1 6ba2a21321beeef65404429d0a4b6380.cloudfront.net (CloudFront), 1.1 89791e6b21b9a30cc51cac1bc51cf098.cloudfront.net (CloudFront), 1.1 google
date: Sat, 15 Oct 2022 07:36:37 GMT
age: 82561
etag: "2010f9656d87e6f5220f131628c537720c3673e1"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbc2961d5-5c3c-41f9-9f68-1ffdbc852581.jpeg
200 OK 8.0 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbc2961d5-5c3c-41f9-9f68-1ffdbc852581.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash dba6e2332080f3b6c7edd6400a328d77
2fe9ab49ee40a2aec3084ed18ef457aecf3f3757
9cfbe2aa4d5544b278ac75bf3ebd12ee576ca054da2ddf1ead3529940891d386
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fbc2961d5-5c3c-41f9-9f68-1ffdbc852581.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8007
x-amzn-requestid: 308881cf-addb-4995-91fc-d8df1d91f3f2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aEM1PHjMoAMFZZw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-634b2821-5db9f4a67c2151ed1eb72837;Sampled=0
x-amzn-remapped-date: Sat, 15 Oct 2022 21:37:37 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Miss from cloudfront
x-amz-cf-id: 9uVVNK741OSPGLE1Jg_Qjdrpm_Xkp6CRFjtWDlxvcUtYO8hvadsydA==
via: 1.1 0005a84c2971ff4f5bbb79e7ebc622a8.cloudfront.net (CloudFront), 1.1 567b44ed19c8caed2570b7bcd8c70034.cloudfront.net (CloudFront), 1.1 google
date: Sat, 15 Oct 2022 21:53:43 GMT
age: 31135
etag: "2fe9ab49ee40a2aec3084ed18ef457aecf3f3757"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9d61d4a8-676c-4b08-8677-2efc6972f950.jpeg
200 OK 8.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9d61d4a8-676c-4b08-8677-2efc6972f950.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 844bf1a50554be9523ea9182c4b00479
71eb020b1ba536fccd126706f183fe4e9cb25cff
7effcdb6cc6a70456d662619a7a50a63dc29c2b3b57b269c81227bf1cd3603d4
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F9d61d4a8-676c-4b08-8677-2efc6972f950.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 8240
x-amzn-requestid: 8fb67ce4-dff5-4d84-baff-2e7362dc226b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aENlYEzmoAMFRdg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-634b2955-199d2b48763443ab750cbd1c;Sampled=0
x-amzn-remapped-date: Sat, 15 Oct 2022 21:42:45 GMT
x-amz-cf-pop: YVR50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 2YVmAkJZRcV-7lfLFd-oi087ew7wG0lVItjubVFyeLeuDPpxOwT0Nw==
via: 1.1 78c1c4eb451e4790ed630b0d5a576590.cloudfront.net (CloudFront), 1.1 89791e6b21b9a30cc51cac1bc51cf098.cloudfront.net (CloudFront), 1.1 google
date: Sat, 15 Oct 2022 22:09:55 GMT
age: 30163
etag: "71eb020b1ba536fccd126706f183fe4e9cb25cff"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4cebbc75-2448-4faf-839b-c39ac6e47b98.jpeg
200 OK 7.3 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4cebbc75-2448-4faf-839b-c39ac6e47b98.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 6432c2bf0bab32f918d931dd98a6e1e4
bba4f37b146e5aea2b6490f8f7da63fa61ffc849
bde0d98cb1dcd70f22cd2aee5860eb0cd824d1bb12ab18245ab8eed06a79cf1d
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F4cebbc75-2448-4faf-839b-c39ac6e47b98.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 7337
x-amzn-requestid: 43a16c4d-c5b9-4d01-8ba4-e811b09e96b1
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: Z-WYqEwVoAMFe5A=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6348d104-121eda8b7a73518849342e7a;Sampled=0
x-amzn-remapped-date: Fri, 14 Oct 2022 03:01:24 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: HUtvwwtoxo38w1ZiKkBZJL0dL3G7aCdUNzvcUhJ7CZ_Taj_tMyfjAQ==
via: 1.1 25b9a991f871f75614e7f92f97b136a4.cloudfront.net (CloudFront), 1.1 2324edbcb8fc72f617442c65f36a40fc.cloudfront.net (CloudFront), 1.1 google
date: Sun, 16 Oct 2022 05:03:21 GMT
age: 5357
etag: "bba4f37b146e5aea2b6490f8f7da63fa61ffc849"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdeb91747-1466-4fb0-9c5c-e679a1294f9a.jpeg
200 OK 6.2 kB URL HTTP/2 img-getpocket.cdn.mozilla.net/296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdeb91747-1466-4fb0-9c5c-e679a1294f9a.jpeg
IP
File type JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Hash 9460ab18b402041fc437809f09b5ca07
83129b8fcd100f7de5e79f685c8dd49a226fb6bd
bbd9f2db14ede4b5711042f892621aaf6602ccec6be2bee07534b11f2b73e671
GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fdeb91747-1466-4fb0-9c5c-e679a1294f9a.jpeg HTTP/1.1
Host: img-getpocket.cdn.mozilla.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
server: nginx
content-length: 6248
x-amzn-requestid: 0170ca13-eaee-4645-b3ca-0e3db5067dbd
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: aEMw5HMVIAMF2Fw=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-634b2805-272b5ffb16c194ba746d74b6;Sampled=0
x-amzn-remapped-date: Sat, 15 Oct 2022 21:37:09 GMT
x-amz-cf-pop: HIO50-C1, SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: a8j08kCiCITu5kWwdriG13kuFbvBss29qGNLThJAa_EF-ux3OLP5gA==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 5fe5f2a3903f1378941d92eceaf3fa16.cloudfront.net (CloudFront), 1.1 google
date: Sat, 15 Oct 2022 21:37:49 GMT
age: 32089
etag: "83129b8fcd100f7de5e79f685c8dd49a226fb6bd"
content-type: image/jpeg
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2
www1.extensions.net/?tm=1&subid4=1665901956.0127700000&KW1=Lowest%20Car%20Insurance%20Rates&KW2=Lowest%20Car%20Insurance%20Rates&KW3=Elite%20Dating%20Services&KW4=Social%20Media%20Automation%20Marketing%20Software&KW5=B2B%20Travel%20Booking%20System&KW6=Social%20Media%20Automation%20Marketing%20Software&KW7=Online%20Career%20Counseling%20Programs&KW8=Make%20Money%20From%20Home&KW9=Best%20Mortgage%20Refinancing%20Rates&searchbox=0&backfill=0
200 OK 5.7 kB URL HTTP/1.1 www1.extensions.net/?tm=1&subid4=1665901956.0127700000&KW1=Lowest%20Car%20Insurance%20Rates&KW2=Lowest%20Car%20Insurance%20Rates&KW3=Elite%20Dating%20Services&KW4=Social%20Media%20Automation%20Marketing%20Software&KW5=B2B%20Travel%20Booking%20System&KW6=Social%20Media%20Automation%20Marketing%20Software&KW7=Online%20Career%20Counseling%20Programs&KW8=Make%20Money%20From%20Home&KW9=Best%20Mortgage%20Refinancing%20Rates&searchbox=0&backfill=0
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3122)
Hash 454d0f52f92a7f2f585b4abafdf0c201
26b255da102788f4f7df9f1a0e87266a68b5b119
3686a8b16a9fb54c15e06cf0202a08ffea788f2bfd4cc7e10b1b1699037af1f0
GET /?tm=1&subid4=1665901956.0127700000&KW1=Lowest%20Car%20Insurance%20Rates&KW2=Lowest%20Car%20Insurance%20Rates&KW3=Elite%20Dating%20Services&KW4=Social%20Media%20Automation%20Marketing%20Software&KW5=B2B%20Travel%20Booking%20System&KW6=Social%20Media%20Automation%20Marketing%20Software&KW7=Online%20Career%20Counseling%20Programs&KW8=Make%20Money%20From%20Home&KW9=Best%20Mortgage%20Refinancing%20Rates&searchbox=0&backfill=0 HTTP/1.1
Host: www1.extensions.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://extensions.net/
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Sun, 16 Oct 2022 06:32:38 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
X-Buckets: bucket103
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_rCnsLZpBJXEP+ktUWXY1rOxmZ53S868Z14MvvoGZ2HJlb+71tqqBRN3HvseVj3zTtkyZLbBh6tgNbcgAW+uWWA==
X-Template: tpl_CleanPeppermintBlack_twoclick
X-Language: norwegian
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
Content-Encoding: gzip
d38psrni17bvxu.cloudfront.net/scripts/js3caf.js
200 OK 7.0 kB URL HTTP/1.1 d38psrni17bvxu.cloudfront.net/scripts/js3caf.js
IP
File type ASCII text, with very long lines (316)
Hash cce7f943ec8e7b4ba13be4aba6b463d9
220f3e8ca723daa91fd040cf518991a65f2bf110
ba5b7354353b0eec1637564dae072fee662a5b9862f6bf7ed5e60a5a76f2ef44
GET /scripts/js3caf.js HTTP/1.1
Host: d38psrni17bvxu.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www1.extensions.net/
HTTP/1.1 200 OK
Content-Type: application/javascript
Content-Length: 7000
Connection: keep-alive
Server: nginx
Date: Sun, 16 Oct 2022 02:32:47 GMT
Last-Modified: Thu, 14 Jan 2021 10:54:01 GMT
Accept-Ranges: bytes
ETag: "600022c9-1b58"
X-Cache: Hit from cloudfront
Via: 1.1 f46773a8236e136c4f6648dd79a7af8e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: slsaK9NoRFAPaoTwtyKLs1N9TgiafvVDLWCsbqAU6XVId8OcjOs1SQ==
Age: 14391
d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/style.css
200 OK 580 B URL HTTP/1.1 d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/style.css
IP
Hash b9f539b0058b3916aad60a6b50a6b662
1a28bfde5267b2ac4c6de028c3d01ff4d84dbf29
35cc39ab61d8326d0b0105a4420b11f4106685a0d67d609454ef4ef252c48b7b
GET /themes/cleanPeppermintBlack_657d9013/style.css HTTP/1.1
Host: d38psrni17bvxu.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www1.extensions.net/
HTTP/1.1 200 OK
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sat, 15 Oct 2022 06:34:10 GMT
Last-Modified: Thu, 23 Jun 2022 10:44:43 GMT
Content-Encoding: gzip
ETag: W/"62b4441b-555"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 f46773a8236e136c4f6648dd79a7af8e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: w2M1NClmzUufHmJoDaszeeKpo4EFaVR9HCz24bqSrQ7CxQvxtbLuFg==
Age: 86308
d38psrni17bvxu.cloudfront.net/themes/assets/style.css
200 OK 343 B URL HTTP/1.1 d38psrni17bvxu.cloudfront.net/themes/assets/style.css
IP
Hash 03a4a8c322fc0c99b0ee7cbbcc9eabcd
6fc193276de2a3458cd853c474cb9269b900e00d
a535d2296792cb37a2bbad1d9d0546e3383a8a5bfac0d9edda15795c226bddf7
GET /themes/assets/style.css HTTP/1.1
Host: d38psrni17bvxu.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www1.extensions.net/
HTTP/1.1 200 OK
Content-Type: text/css
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Date: Sat, 15 Oct 2022 07:34:23 GMT
Last-Modified: Tue, 12 May 2020 14:25:52 GMT
Content-Encoding: gzip
ETag: W/"5ebab1f0-33d"
Vary: Accept-Encoding
X-Cache: Hit from cloudfront
Via: 1.1 8ac66e1d6983a0f44cf391b1ec3b1cce.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: sSV2ps4Ttq_8-r_O4COksCzJmgPN8qRyTYoLWCT_K8X4-IHH3yTeXg==
Age: 82695
www.google.com/adsense/domains/caf.js
200 OK 54 kB URL HTTP/1.1 www.google.com/adsense/domains/caf.js
IP
File type ASCII text, with very long lines (1885)
Hash 9a9651684feed9d4591dea54f821ca31
dac2a823c41615ef69457035f8f2cc1c1a625a4d
7fa28e86c28b2070bf95bdd9fe414ed4378653932d6a7956cee51d42ab5c4c37
GET /adsense/domains/caf.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www1.extensions.net/
HTTP/1.1 200 OK
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui"
Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
Date: Sun, 16 Oct 2022 06:32:38 GMT
Expires: Sun, 16 Oct 2022 06:32:38 GMT
Cache-Control: private, max-age=3600
ETag: "10805728912785947052"
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: sffe
X-XSS-Protection: 0
c.parkingcrew.net/scripts/sale_form.js
200 OK 761 B URL HTTP/1.1 c.parkingcrew.net/scripts/sale_form.js
IP
Hash 64f809e06446647e192fce8d1ec34e09
5b7ced07da42e205067afa88615317a277a4a82c
f52cbd664986ad7ed6e71c448e2d31d1a16463e4d9b7bca0c6be278649ccc4f3
GET /scripts/sale_form.js HTTP/1.1
Host: c.parkingcrew.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www1.extensions.net/
HTTP/1.1 200 OK
Server: nginx
Date: Sun, 16 Oct 2022 06:32:38 GMT
Content-Type: application/javascript
Content-Length: 761
Connection: keep-alive
Last-Modified: Tue, 12 May 2020 14:25:52 GMT
ETag: "5ebab1f0-2f9"
Accept-Ranges: bytes
d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.png
200 OK 11 kB URL HTTP/1.1 d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/img/arrows.png
IP
File type PNG image data, 1500 x 600, 8-bit colormap, non-interlaced\012- data
Hash 0cb2e5165dc9324eb462199f04e1ffa9
9e0f89847ec8a98d98a6020bc5c4ed32b7a48bf8
67dff0aad873050f12609885f2264417ccdd0d438311000a704c89f0865f7865
GET /themes/cleanPeppermintBlack_657d9013/img/arrows.png HTTP/1.1
Host: d38psrni17bvxu.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://d38psrni17bvxu.cloudfront.net/themes/cleanPeppermintBlack_657d9013/style.css
HTTP/1.1 200 OK
Content-Type: image/png
Content-Length: 11375
Connection: keep-alive
Server: nginx
Date: Sat, 15 Oct 2022 09:14:37 GMT
Last-Modified: Thu, 23 Jun 2022 10:44:43 GMT
Accept-Ranges: bytes
ETag: "62b4441b-2c6f"
X-Cache: Hit from cloudfront
Via: 1.1 f46773a8236e136c4f6648dd79a7af8e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: BSLDlRFZWmyUuavK6mG8fulXcff3jylx4hKcYJoOg058SVV3WB9z4w==
Age: 76681
www1.extensions.net/favicon.ico
200 OK 0 B URL HTTP/1.1 www1.extensions.net/favicon.ico
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /favicon.ico HTTP/1.1
Host: www1.extensions.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www1.extensions.net/?tm=1&subid4=1665901956.0127700000&KW1=Lowest%20Car%20Insurance%20Rates&KW2=Lowest%20Car%20Insurance%20Rates&KW3=Elite%20Dating%20Services&KW4=Social%20Media%20Automation%20Marketing%20Software&KW5=B2B%20Travel%20Booking%20System&KW6=Social%20Media%20Automation%20Marketing%20Software&KW7=Online%20Career%20Counseling%20Programs&KW8=Make%20Money%20From%20Home&KW9=Best%20Mortgage%20Refinancing%20Rates&searchbox=0&backfill=0
HTTP/1.1 200 OK
Date: Sun, 16 Oct 2022 06:32:38 GMT
Content-Type: image/x-icon
Content-Length: 0
Connection: keep-alive
Server: nginx
Last-Modified: Tue, 12 May 2020 14:25:52 GMT
ETag: "5ebab1f0-0"
Accept-Ranges: bytes
www1.extensions.net/track.php?domain=extensions.net&toggle=browserjs&uid=MTY2NTkwMTk1OC4wMjkyOmRiOTRiNzkyMjg1Yzg4OGE4N2IzOTRlNWZhM2QwZGI2ZWQwNTdhZjVlNzQxNDEyOWIxY2VhNTdjZDcyOWZkZjc6NjM0YmE1ODYwNzFlNQ%3D%3D
200 OK 20 B URL HTTP/1.1 www1.extensions.net/track.php?domain=extensions.net&toggle=browserjs&uid=MTY2NTkwMTk1OC4wMjkyOmRiOTRiNzkyMjg1Yzg4OGE4N2IzOTRlNWZhM2QwZGI2ZWQwNTdhZjVlNzQxNDEyOWIxY2VhNTdjZDcyOWZkZjc6NjM0YmE1ODYwNzFlNQ%3D%3D
IP
Hash a4745abc5e7fdb89cc6df3069f3c6e69
74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf
GET /track.php?domain=extensions.net&toggle=browserjs&uid=MTY2NTkwMTk1OC4wMjkyOmRiOTRiNzkyMjg1Yzg4OGE4N2IzOTRlNWZhM2QwZGI2ZWQwNTdhZjVlNzQxNDEyOWIxY2VhNTdjZDcyOWZkZjc6NjM0YmE1ODYwNzFlNQ%3D%3D HTTP/1.1
Host: www1.extensions.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www1.extensions.net/?tm=1&subid4=1665901956.0127700000&KW1=Lowest%20Car%20Insurance%20Rates&KW2=Lowest%20Car%20Insurance%20Rates&KW3=Elite%20Dating%20Services&KW4=Social%20Media%20Automation%20Marketing%20Software&KW5=B2B%20Travel%20Booking%20System&KW6=Social%20Media%20Automation%20Marketing%20Software&KW7=Online%20Career%20Counseling%20Programs&KW8=Make%20Money%20From%20Home&KW9=Best%20Mortgage%20Refinancing%20Rates&searchbox=0&backfill=0
HTTP/1.1 200 OK
Date: Sun, 16 Oct 2022 06:32:39 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
X-Custom-Track: browserjs
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
Access-Control-Allow-Origin: *
Content-Encoding: gzip
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 4f05f7d85c5d7c2aa09651804f80a019
cd118fbc41657bfdf0fcfb9e3a4a2813f3b08e5b
76a6c1ae0a435403ac10b6478f029bb8b871dbdcc2a2c7e3e97b56982a9767e7
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 16 Oct 2022 06:32:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 3f1ddf48f38bb4cbabd67c207aa0f407
51f08476ed6b1789da55cdc10287034a24eff6f4
927a97847f88ad2ecae86fef7050c64db6f17d3d4f054546531f8669cece5262
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 16 Oct 2022 06:32:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
afs.googlesyndication.com/afs/ads?adtest=off&psid=6016880802&pcsa=false&channel=000001%2C000003%2C001068%2Cbucket103&client=dp-teaminternet12_3ph&r=m&hl=en&terms=Lowest%20Car%20Insurance%20Rates%2CLowest%20Car%20Insurance%20Rates%2CElite%20Dating%20Services%2CSocial%20Media%20Automation%20Marketing%20Software%2CB2B%20Travel%20Booking%20System%2CSocial%20Media%20Automation%20Marketing%20Software%2COnline%20Career%20Counseling%20Programs%2CMake%20Money%20From%20Home%2CBest%20Mortgage%20Refinancing%20Rates&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2514429714757505&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002%2C17300934%2C17300936%2C17300953%2C17300956%2C17301068%2C17301071%2C17301094%2C17301097&format=r9%7Cs&nocache=791665901961762&num=0&output=afd_ads&domain_name=www1.extensions.net&v=3&bsl=8&pac=2&u_his=2&u_tz=0&dt=1665901961763&u_w=1280&u_h=1024&biw=1280&bih=939&psw=1280&psh=797&frm=0&cl=480127119&uio=--&cont=tc&jsid=caf&jsv=480127119&rurl=http%3A%2F%2Fwww1.extensions.net%2F%3Ftm%3D1%26subid4%3D1665901956.0127700000%26KW1%3DLowest%2520Car%2520Insurance%2520Rates%26KW2%3DLowest%2520Car%2520Insurance%2520Rates%26KW3%3DElite%2520Dating%2520Services%26KW4%3DSocial%2520Media%2520Automation%2520Marketing%2520Software%26KW5%3DB2B%2520Travel%2520Booking%2520System%26KW6%3DSocial%2520Media%2520Automation%2520Marketing%2520Software%26KW7%3DOnline%2520Career%2520Counseling%2520Programs%26KW8%3DMake%2520Money%2520From%2520Home%26KW9%3DBest%2520Mortgage%2520Refinancing%2520Rates%26searchbox%3D0%26backfill%3D0&referer=http%3A%2F%2Fextensions.net%2F&adbw=master-1%3A530
200 OK 2.6 kB URL HTTP/2 afs.googlesyndication.com/afs/ads?adtest=off&psid=6016880802&pcsa=false&channel=000001%2C000003%2C001068%2Cbucket103&client=dp-teaminternet12_3ph&r=m&hl=en&terms=Lowest%20Car%20Insurance%20Rates%2CLowest%20Car%20Insurance%20Rates%2CElite%20Dating%20Services%2CSocial%20Media%20Automation%20Marketing%20Software%2CB2B%20Travel%20Booking%20System%2CSocial%20Media%20Automation%20Marketing%20Software%2COnline%20Career%20Counseling%20Programs%2CMake%20Money%20From%20Home%2CBest%20Mortgage%20Refinancing%20Rates&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2514429714757505&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002%2C17300934%2C17300936%2C17300953%2C17300956%2C17301068%2C17301071%2C17301094%2C17301097&format=r9%7Cs&nocache=791665901961762&num=0&output=afd_ads&domain_name=www1.extensions.net&v=3&bsl=8&pac=2&u_his=2&u_tz=0&dt=1665901961763&u_w=1280&u_h=1024&biw=1280&bih=939&psw=1280&psh=797&frm=0&cl=480127119&uio=--&cont=tc&jsid=caf&jsv=480127119&rurl=http%3A%2F%2Fwww1.extensions.net%2F%3Ftm%3D1%26subid4%3D1665901956.0127700000%26KW1%3DLowest%2520Car%2520Insurance%2520Rates%26KW2%3DLowest%2520Car%2520Insurance%2520Rates%26KW3%3DElite%2520Dating%2520Services%26KW4%3DSocial%2520Media%2520Automation%2520Marketing%2520Software%26KW5%3DB2B%2520Travel%2520Booking%2520System%26KW6%3DSocial%2520Media%2520Automation%2520Marketing%2520Software%26KW7%3DOnline%2520Career%2520Counseling%2520Programs%26KW8%3DMake%2520Money%2520From%2520Home%26KW9%3DBest%2520Mortgage%2520Refinancing%2520Rates%26searchbox%3D0%26backfill%3D0&referer=http%3A%2F%2Fextensions.net%2F&adbw=master-1%3A530
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (8841)
Hash 93a2df3c1217aef783d01710ff78dbbd
05bf1f7e138e4a3a82281cab171ae2616ccb7e6b
edfb0ead8aba0c23cf19bfee6ee2de184fe036a12d0fa89bdc39e5824b802baf
GET /afs/ads?adtest=off&psid=6016880802&pcsa=false&channel=000001%2C000003%2C001068%2Cbucket103&client=dp-teaminternet12_3ph&r=m&hl=en&terms=Lowest%20Car%20Insurance%20Rates%2CLowest%20Car%20Insurance%20Rates%2CElite%20Dating%20Services%2CSocial%20Media%20Automation%20Marketing%20Software%2CB2B%20Travel%20Booking%20System%2CSocial%20Media%20Automation%20Marketing%20Software%2COnline%20Career%20Counseling%20Programs%2CMake%20Money%20From%20Home%2CBest%20Mortgage%20Refinancing%20Rates&max_radlink_len=40&type=3&uiopt=true&swp=as-drid-2514429714757505&oe=UTF-8&ie=UTF-8&fexp=21404%2C17300002%2C17300934%2C17300936%2C17300953%2C17300956%2C17301068%2C17301071%2C17301094%2C17301097&format=r9%7Cs&nocache=791665901961762&num=0&output=afd_ads&domain_name=www1.extensions.net&v=3&bsl=8&pac=2&u_his=2&u_tz=0&dt=1665901961763&u_w=1280&u_h=1024&biw=1280&bih=939&psw=1280&psh=797&frm=0&cl=480127119&uio=--&cont=tc&jsid=caf&jsv=480127119&rurl=http%3A%2F%2Fwww1.extensions.net%2F%3Ftm%3D1%26subid4%3D1665901956.0127700000%26KW1%3DLowest%2520Car%2520Insurance%2520Rates%26KW2%3DLowest%2520Car%2520Insurance%2520Rates%26KW3%3DElite%2520Dating%2520Services%26KW4%3DSocial%2520Media%2520Automation%2520Marketing%2520Software%26KW5%3DB2B%2520Travel%2520Booking%2520System%26KW6%3DSocial%2520Media%2520Automation%2520Marketing%2520Software%26KW7%3DOnline%2520Career%2520Counseling%2520Programs%26KW8%3DMake%2520Money%2520From%2520Home%26KW9%3DBest%2520Mortgage%2520Refinancing%2520Rates%26searchbox%3D0%26backfill%3D0&referer=http%3A%2F%2Fextensions.net%2F&adbw=master-1%3A530 HTTP/1.1
Host: afs.googlesyndication.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www1.extensions.net/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
content-type: text/html; charset=UTF-8
content-disposition: inline
date: Sun, 16 Oct 2022 06:32:39 GMT
expires: Sun, 16 Oct 2022 06:32:39 GMT
cache-control: private, max-age=3600
content-encoding: br
server: gws
content-length: 2581
x-xss-protection: 0
set-cookie: CONSENT=PENDING+121; expires=Tue, 15-Oct-2024 06:32:39 GMT; path=/; domain=.googlesyndication.com; Secure
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
partner.googleadservices.com/gampad/cookie.js?domain=www1.extensions.net&client=dp-teaminternet12_3ph&product=SAS&callback=__sasCookie
200 OK 186 B URL HTTP/2 partner.googleadservices.com/gampad/cookie.js?domain=www1.extensions.net&client=dp-teaminternet12_3ph&product=SAS&callback=__sasCookie
IP
File type ASCII text, with no line terminators
Hash 4b99d39d4c2b908b294314729eda4732
7cf546d0d92e6301f6fc31c4e884c8f31d94eca8
4bfa5ce59427425cb1728feb1867b769574b7bb588b8fc7a046c0e6a8f852765
GET /gampad/cookie.js?domain=www1.extensions.net&client=dp-teaminternet12_3ph&product=SAS&callback=__sasCookie HTTP/1.1
Host: partner.googleadservices.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www1.extensions.net/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
p3p: policyref="https://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA IVD OTP OUR OTR IND OTC"
timing-allow-origin: *
cross-origin-resource-policy: cross-origin
content-type: text/javascript; charset=UTF-8
x-content-type-options: nosniff
content-disposition: attachment; filename="f.txt"
content-encoding: gzip
date: Sun, 16 Oct 2022 06:32:39 GMT
server: cafe
cache-control: private
content-length: 186
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 4f05f7d85c5d7c2aa09651804f80a019
cd118fbc41657bfdf0fcfb9e3a4a2813f3b08e5b
76a6c1ae0a435403ac10b6478f029bb8b871dbdcc2a2c7e3e97b56982a9767e7
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 16 Oct 2022 06:32:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 3f1ddf48f38bb4cbabd67c207aa0f407
51f08476ed6b1789da55cdc10287034a24eff6f4
927a97847f88ad2ecae86fef7050c64db6f17d3d4f054546531f8669cece5262
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 16 Oct 2022 06:32:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash eaec157896b4103f8d4d6d7322b18b9d
45f4cc9bf0c5cc04ae4388682a8e058f58e30666
1b51a26aecfb438b88ca21570614048ec6232aafc94ee1049846dda6e868c400
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 16 Oct 2022 06:32:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash eaec157896b4103f8d4d6d7322b18b9d
45f4cc9bf0c5cc04ae4388682a8e058f58e30666
1b51a26aecfb438b88ca21570614048ec6232aafc94ee1049846dda6e868c400
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 16 Oct 2022 06:32:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff
200 OK 270 B URL HTTP/2 afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff
IP
File type SVG Scalable Vector Graphics image\012- , ASCII text, with very long lines (390)
Hash 5100391430a00e10ce60aa159f525b5c
231a4492d73b225f441b1e9028dc33c89862e498
52b1432a6e3002e41ed1d8f4c84b258fdc4c6dac863e3c0e5c06360c81be6067
GET /ad_icons/standard/publisher_icon_image/search.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://afs.googlesyndication.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 270
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Sat, 15 Oct 2022 20:02:58 GMT
expires: Sun, 16 Oct 2022 19:02:58 GMT
cache-control: public, max-age=82800
age: 37781
last-modified: Thu, 19 Dec 2019 14:15:00 GMT
content-type: image/svg+xml
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff
200 OK 174 B URL HTTP/2 afs.googleusercontent.com/ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff
IP
File type SVG Scalable Vector Graphics image\012- , ASCII text, with no line terminators
Hash 4de8b85c8915995b571bde50e231be7c
29c226ca7b9cbe1d44e5480ce95bbb42727b2d99
2ec9168c4507546748c5f400f5030031f0eb06f2aed8deaa11362c395bff4f7a
GET /ad_icons/standard/publisher_icon_image/chevron.svg?c=%23ffffff HTTP/1.1
Host: afs.googleusercontent.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://afs.googlesyndication.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-security-policy: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/afs-native-asset-managers
cross-origin-opener-policy: same-origin; report-to="afs-native-asset-managers"
report-to: {"group":"afs-native-asset-managers","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/afs-native-asset-managers"}]}
content-length: 174
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
date: Sun, 16 Oct 2022 05:04:21 GMT
expires: Mon, 17 Oct 2022 04:04:21 GMT
cache-control: public, max-age=82800
age: 5298
last-modified: Thu, 22 Oct 2020 21:45:00 GMT
content-type: image/svg+xml
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
www1.extensions.net/ls.php
201 Created 0 B URL HTTP/1.1 www1.extensions.net/ls.php
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert fortinet Malware
POST /ls.php HTTP/1.1
Host: www1.extensions.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 3074
Origin: http://www1.extensions.net
Connection: keep-alive
Referer: http://www1.extensions.net/?tm=1&subid4=1665901956.0127700000&KW1=Lowest%20Car%20Insurance%20Rates&KW2=Lowest%20Car%20Insurance%20Rates&KW3=Elite%20Dating%20Services&KW4=Social%20Media%20Automation%20Marketing%20Software&KW5=B2B%20Travel%20Booking%20System&KW6=Social%20Media%20Automation%20Marketing%20Software&KW7=Online%20Career%20Counseling%20Programs&KW8=Make%20Money%20From%20Home&KW9=Best%20Mortgage%20Refinancing%20Rates&searchbox=0&backfill=0
HTTP/1.1 201 Created
Date: Sun, 16 Oct 2022 06:32:39 GMT
Content-Type: text/javascript;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
X-Log-Success: 634ba587ae01a2377a570421
Charset: utf-8
Access-Control-Allow-Origin: http://www1.extensions.net
Access-Control-Allow-Methods: POST, OPTIONS
Access-Control-Max-Age: 86400
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_QljL+Us/6VVmV65mVAnEv9vC/KrSv3Eo+c68LfgcyhmBfkJKph4K0m1t91AEjNQTgi03PnbHMeLHtfsmoGTghA==
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash eaec157896b4103f8d4d6d7322b18b9d
45f4cc9bf0c5cc04ae4388682a8e058f58e30666
1b51a26aecfb438b88ca21570614048ec6232aafc94ee1049846dda6e868c400
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 16 Oct 2022 06:32:39 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www1.extensions.net/?tm=1&subid4=1665901956.0127700000&KW1=Lowest%20Car%20Insurance%20Rates&KW2=Lowest%20Car%20Insurance%20Rates&KW3=Elite%20Dating%20Services&KW4=Social%20Media%20Automation%20Marketing%20Software&KW5=B2B%20Travel%20Booking%20System&KW6=Social%20Media%20Automation%20Marketing%20Software&KW7=Online%20Career%20Counseling%20Programs&KW8=Make%20Money%20From%20Home&KW9=Best%20Mortgage%20Refinancing%20Rates&searchbox=0&backfill=0
200 OK 5.7 kB URL HTTP/1.1 www1.extensions.net/?tm=1&subid4=1665901956.0127700000&KW1=Lowest%20Car%20Insurance%20Rates&KW2=Lowest%20Car%20Insurance%20Rates&KW3=Elite%20Dating%20Services&KW4=Social%20Media%20Automation%20Marketing%20Software&KW5=B2B%20Travel%20Booking%20System&KW6=Social%20Media%20Automation%20Marketing%20Software&KW7=Online%20Career%20Counseling%20Programs&KW8=Make%20Money%20From%20Home&KW9=Best%20Mortgage%20Refinancing%20Rates&searchbox=0&backfill=0
IP
File type HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (3094)
Hash 68e45b0706f01d0f20434fc64093ed30
cda991810eb7cb9fc3c7883efa2e218879d21692
cad20d3d1957a0c5ce8fddf1eb78da9d2d6c045907315950ae54196176d68eb3
GET /?tm=1&subid4=1665901956.0127700000&KW1=Lowest%20Car%20Insurance%20Rates&KW2=Lowest%20Car%20Insurance%20Rates&KW3=Elite%20Dating%20Services&KW4=Social%20Media%20Automation%20Marketing%20Software&KW5=B2B%20Travel%20Booking%20System&KW6=Social%20Media%20Automation%20Marketing%20Software&KW7=Online%20Career%20Counseling%20Programs&KW8=Make%20Money%20From%20Home&KW9=Best%20Mortgage%20Refinancing%20Rates&searchbox=0&backfill=0 HTTP/1.1
Host: www1.extensions.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Cookie: __gsas=ID=4607a8ace520336d:T=1665901959:S=ALNI_MYLMt97vLVOSfKCkbRAIi5W-CXHlA
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
HTTP/1.1 200 OK
Date: Sun, 16 Oct 2022 06:32:39 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
X-Buckets: bucket103
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_rCnsLZpBJXEP+ktUWXY1rOxmZ53S868Z14MvvoGZ2HJlb+71tqqBRN3HvseVj3zTtkyZLbBh6tgNbcgAW+uWWA==
X-Template: tpl_CleanPeppermintBlack_twoclick
X-Language: norwegian
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
Content-Encoding: gzip
d38psrni17bvxu.cloudfront.net/scripts/js3caf.js
304 Not Modified 0 B URL HTTP/1.1 d38psrni17bvxu.cloudfront.net/scripts/js3caf.js
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /scripts/js3caf.js HTTP/1.1
Host: d38psrni17bvxu.cloudfront.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www1.extensions.net/
If-Modified-Since: Thu, 14 Jan 2021 10:54:01 GMT
If-None-Match: "600022c9-1b58"
Cache-Control: max-age=0
HTTP/1.1 304 Not Modified
Connection: keep-alive
Server: nginx
Date: Sun, 16 Oct 2022 02:32:47 GMT
Last-Modified: Thu, 14 Jan 2021 10:54:01 GMT
ETag: "600022c9-1b58"
X-Cache: Hit from cloudfront
Via: 1.1 f46773a8236e136c4f6648dd79a7af8e.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-P1
X-Amz-Cf-Id: MNBOn5mSQ049qPDezWpB3FUUilaw2N72pcXCgW7SFWsUTqvgB2xbdw==
Age: 14392
www.google.com/adsense/domains/caf.js
200 OK 54 kB URL HTTP/1.1 www.google.com/adsense/domains/caf.js
IP
File type ASCII text, with very long lines (1885)
Hash 058cf256105a1d5435265e4022a7c9c3
93b524c35a0650142cd62719c93ae33709d0c040
2d1488bad0a381bfef467b376573968b243dc4f572ac8699cfe4a7aecdf38179
GET /adsense/domains/caf.js HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www1.extensions.net/
If-None-Match: "10805728912785947052"
Cache-Control: max-age=0
HTTP/1.1 200 OK
Accept-Ranges: bytes
Vary: Accept-Encoding
Content-Type: text/javascript; charset=UTF-8
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="ads-afs-ui"
Report-To: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
Date: Sun, 16 Oct 2022 06:32:39 GMT
Expires: Sun, 16 Oct 2022 06:32:39 GMT
Cache-Control: private, max-age=3600
ETag: "15315074195490577123"
X-Content-Type-Options: nosniff
Content-Encoding: gzip
Transfer-Encoding: chunked
Server: sffe
X-XSS-Protection: 0
c.parkingcrew.net/scripts/sale_form.js
304 Not Modified 0 B URL HTTP/1.1 c.parkingcrew.net/scripts/sale_form.js
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /scripts/sale_form.js HTTP/1.1
Host: c.parkingcrew.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www1.extensions.net/
If-Modified-Since: Tue, 12 May 2020 14:25:52 GMT
If-None-Match: "5ebab1f0-2f9"
Cache-Control: max-age=0
HTTP/1.1 304 Not Modified
Server: nginx
Date: Sun, 16 Oct 2022 06:32:39 GMT
Connection: keep-alive
Last-Modified: Tue, 12 May 2020 14:25:52 GMT
ETag: "5ebab1f0-2f9"
www1.extensions.net/track.php?domain=extensions.net&toggle=browserjs&uid=MTY2NTkwMTk1OS41NDI0OjJlYjg0NTVjYjcxYjNjM2M1NTllNjg1NzE1ZmY1MjEzMzE1MjczZmMwMDlhNzU5NmQ4N2NiN2M5MmUxNjVjOTI6NjM0YmE1ODc4NDZlZg%3D%3D
200 OK 20 B URL HTTP/1.1 www1.extensions.net/track.php?domain=extensions.net&toggle=browserjs&uid=MTY2NTkwMTk1OS41NDI0OjJlYjg0NTVjYjcxYjNjM2M1NTllNjg1NzE1ZmY1MjEzMzE1MjczZmMwMDlhNzU5NmQ4N2NiN2M5MmUxNjVjOTI6NjM0YmE1ODc4NDZlZg%3D%3D
IP
Hash a4745abc5e7fdb89cc6df3069f3c6e69
74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf
GET /track.php?domain=extensions.net&toggle=browserjs&uid=MTY2NTkwMTk1OS41NDI0OjJlYjg0NTVjYjcxYjNjM2M1NTllNjg1NzE1ZmY1MjEzMzE1MjczZmMwMDlhNzU5NmQ4N2NiN2M5MmUxNjVjOTI6NjM0YmE1ODc4NDZlZg%3D%3D HTTP/1.1
Host: www1.extensions.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www1.extensions.net/?tm=1&subid4=1665901956.0127700000&KW1=Lowest%20Car%20Insurance%20Rates&KW2=Lowest%20Car%20Insurance%20Rates&KW3=Elite%20Dating%20Services&KW4=Social%20Media%20Automation%20Marketing%20Software&KW5=B2B%20Travel%20Booking%20System&KW6=Social%20Media%20Automation%20Marketing%20Software&KW7=Online%20Career%20Counseling%20Programs&KW8=Make%20Money%20From%20Home&KW9=Best%20Mortgage%20Refinancing%20Rates&searchbox=0&backfill=0
Cookie: __gsas=ID=4607a8ace520336d:T=1665901959:S=ALNI_MYLMt97vLVOSfKCkbRAIi5W-CXHlA
HTTP/1.1 200 OK
Date: Sun, 16 Oct 2022 06:32:40 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
X-Custom-Track: browserjs
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
Access-Control-Allow-Origin: *
Content-Encoding: gzip
www1.extensions.net/ls.php
201 Created 0 B URL HTTP/1.1 www1.extensions.net/ls.php
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Analyzer Verdict Alert fortinet Malware
POST /ls.php HTTP/1.1
Host: www1.extensions.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 3046
Origin: http://www1.extensions.net
Connection: keep-alive
Referer: http://www1.extensions.net/?tm=1&subid4=1665901956.0127700000&KW1=Lowest%20Car%20Insurance%20Rates&KW2=Lowest%20Car%20Insurance%20Rates&KW3=Elite%20Dating%20Services&KW4=Social%20Media%20Automation%20Marketing%20Software&KW5=B2B%20Travel%20Booking%20System&KW6=Social%20Media%20Automation%20Marketing%20Software&KW7=Online%20Career%20Counseling%20Programs&KW8=Make%20Money%20From%20Home&KW9=Best%20Mortgage%20Refinancing%20Rates&searchbox=0&backfill=0
Cookie: __gsas=ID=4607a8ace520336d:T=1665901959:S=ALNI_MYLMt97vLVOSfKCkbRAIi5W-CXHlA
Cache-Control: max-age=0
HTTP/1.1 201 Created
Date: Sun, 16 Oct 2022 06:32:40 GMT
Content-Type: text/javascript;charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
X-Log-Success: 634ba588f1491b4dc5430bce
Charset: utf-8
Access-Control-Allow-Origin: http://www1.extensions.net
Access-Control-Allow-Methods: POST, OPTIONS
Access-Control-Max-Age: 86400
X-Adblock-Key: MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBALquDFETXRn0Hr05fUP7EJT77xYnPmRbpMy4vk8KYiHnkNpednjOANJcaXDXcKQJN0nXKZJL7TciJD8AoHXK158CAwEAAQ==_QljL+Us/6VVmV65mVAnEv9vC/KrSv3Eo+c68LfgcyhmBfkJKph4K0m1t91AEjNQTgi03PnbHMeLHtfsmoGTghA==
www1.extensions.net/track.php?domain=extensions.net&caf=1&toggle=answercheck&answer=yes&uid=MTY2NTkwMTk1OS41NDI0OjJlYjg0NTVjYjcxYjNjM2M1NTllNjg1NzE1ZmY1MjEzMzE1MjczZmMwMDlhNzU5NmQ4N2NiN2M5MmUxNjVjOTI6NjM0YmE1ODc4NDZlZg%3D%3D
200 OK 20 B URL HTTP/1.1 www1.extensions.net/track.php?domain=extensions.net&caf=1&toggle=answercheck&answer=yes&uid=MTY2NTkwMTk1OS41NDI0OjJlYjg0NTVjYjcxYjNjM2M1NTllNjg1NzE1ZmY1MjEzMzE1MjczZmMwMDlhNzU5NmQ4N2NiN2M5MmUxNjVjOTI6NjM0YmE1ODc4NDZlZg%3D%3D
IP
Hash a4745abc5e7fdb89cc6df3069f3c6e69
74789f7ddbebd5b7323f6f8174005b4bf8c1f1ed
d1111b245f685176180e6f1631e6dc49badf6672368e9ce260c71355165effdf
GET /track.php?domain=extensions.net&caf=1&toggle=answercheck&answer=yes&uid=MTY2NTkwMTk1OS41NDI0OjJlYjg0NTVjYjcxYjNjM2M1NTllNjg1NzE1ZmY1MjEzMzE1MjczZmMwMDlhNzU5NmQ4N2NiN2M5MmUxNjVjOTI6NjM0YmE1ODc4NDZlZg%3D%3D HTTP/1.1
Host: www1.extensions.net
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://www1.extensions.net/?tm=1&subid4=1665901956.0127700000&KW1=Lowest%20Car%20Insurance%20Rates&KW2=Lowest%20Car%20Insurance%20Rates&KW3=Elite%20Dating%20Services&KW4=Social%20Media%20Automation%20Marketing%20Software&KW5=B2B%20Travel%20Booking%20System&KW6=Social%20Media%20Automation%20Marketing%20Software&KW7=Online%20Career%20Counseling%20Programs&KW8=Make%20Money%20From%20Home&KW9=Best%20Mortgage%20Refinancing%20Rates&searchbox=0&backfill=0
Cookie: __gsas=ID=4607a8ace520336d:T=1665901959:S=ALNI_MYLMt97vLVOSfKCkbRAIi5W-CXHlA
HTTP/1.1 200 OK
Date: Sun, 16 Oct 2022 06:32:40 GMT
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Connection: keep-alive
Server: nginx
Vary: Accept-Encoding
X-Custom-Track: answercheck
Accept-CH: viewport-width, dpr, device-memory, rtt, downlink, ect, ua, ua-full-version, ua-platform, ua-platform-version, ua-arch, ua-model, ua-mobile
Accept-CH-Lifetime: 30
Access-Control-Allow-Origin: *
Content-Encoding: gzip
ocsp.pki.goog/gts1c3
200 OK 472 B IP
Hash 231a5834edd086a67640c2c0cc18c55c
3427d0baffebad62c95754da193be354ca2b270c
2533d2d520b731b0073fcd224375cdd6dc2fde77908f93dcb0c659ec6dc7501b
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 16 Oct 2022 06:32:42 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
www.google.com/afs/gen_204?client=dp-teaminternet12_3ph&output=uds_ads_only&zx=8ka77964wmum&aqid=iKVLY5anIJOAiM0PhYeZ-Ag&psid=6016880802&pbt=bs&adbx=369&adby=131&adbh=1189&adbw=530&adbah=156%2C156%2C182%2C156%2C182%2C156%2C182&adbn=master-1&eawp=partner-dp-teaminternet12_3ph&errv=480127119&csala=9%7C0%7C134%7C41%7C194&lle=0&llm=1000&ifv=1&usr=1
204 No Content 0 B URL HTTP/2 www.google.com/afs/gen_204?client=dp-teaminternet12_3ph&output=uds_ads_only&zx=8ka77964wmum&aqid=iKVLY5anIJOAiM0PhYeZ-Ag&psid=6016880802&pbt=bs&adbx=369&adby=131&adbh=1189&adbw=530&adbah=156%2C156%2C182%2C156%2C182%2C156%2C182&adbn=master-1&eawp=partner-dp-teaminternet12_3ph&errv=480127119&csala=9%7C0%7C134%7C41%7C194&lle=0&llm=1000&ifv=1&usr=1
IP
Hash d41d8cd98f00b204e9800998ecf8427e
da39a3ee5e6b4b0d3255bfef95601890afd80709
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
GET /afs/gen_204?client=dp-teaminternet12_3ph&output=uds_ads_only&zx=8ka77964wmum&aqid=iKVLY5anIJOAiM0PhYeZ-Ag&psid=6016880802&pbt=bs&adbx=369&adby=131&adbh=1189&adbw=530&adbah=156%2C156%2C182%2C156%2C182%2C156%2C182&adbn=master-1&eawp=partner-dp-teaminternet12_3ph&errv=480127119&csala=9%7C0%7C134%7C41%7C194&lle=0&llm=1000&ifv=1&usr=1 HTTP/1.1
Host: www.google.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: http://www1.extensions.net/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
HTTP/2 204 No Content
content-type: text/html; charset=UTF-8
p3p: CP="This is not a P3P policy! See g.co/p3phelp for more info."
date: Sun, 16 Oct 2022 06:32:42 GMT
server: gws
content-length: 0
x-xss-protection: 0
x-frame-options: SAMEORIGIN
set-cookie: NID=511=XiqWtTdm17SlcMPjtu7rxQzls7zwdBiRLuu3QiHWekpJnLcn7fre6Cv4tJ1tfs_AePCXlXIy8zHfOyyiK7z2FlTlMA5ijMsOT1W6HhMgIKvC8AXctKNsLbrlgEkNoxgmz6pe4tceehD2AgyefUVmjAHIznjSV6V8fYxz5LXTS4U; expires=Mon, 17-Apr-2023 06:32:42 GMT; path=/; domain=.google.com; Secure; HttpOnly; SameSite=none
CONSENT=PENDING+334; expires=Tue, 15-Oct-2024 06:32:42 GMT; path=/; domain=.google.com; Secure
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
ocsp.pki.goog/gts1c3
200 OK 471 B IP
Hash b71c1dfe563720287179a76edf29c680
6096cc371998151d37a2f7698b0fe0371bb43269
7472e945b0ae9b967b68ec85dc8a005c74c2f5c63c68a9de142be69983062a90
POST /gts1c3 HTTP/1.1
Host: ocsp.pki.goog
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
Date: Sun, 16 Oct 2022 06:32:42 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN
afs.googlesyndication.com/adsense/domains/caf.js
200 OK 0 B URL HTTP/2 afs.googlesyndication.com/adsense/domains/caf.js
IP
GET /adsense/domains/caf.js HTTP/1.1
Host: afs.googlesyndication.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://afs.googlesyndication.com/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
TE: trailers
HTTP/2 200 OK
accept-ranges: bytes
vary: Accept-Encoding
content-type: text/javascript; charset=UTF-8
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/ads-afs-ui
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="ads-afs-ui"
report-to: {"group":"ads-afs-ui","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/ads-afs-ui"}]}
date: Sun, 16 Oct 2022 06:32:39 GMT
expires: Sun, 16 Oct 2022 06:32:39 GMT
cache-control: private, max-age=3600
etag: "2438768568342620925"
x-content-type-options: nosniff
content-encoding: gzip
server: sffe
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2
45.33.23.183
185.53.178.30
23.36.76.226
93.184.220.29
0.0.0.0